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DETAILED ACTION 

1 . This action is in response to tine amendment filed on 07/1 1/2008. 

2. Claims 1 , 3-6, 1 0-1 3, 1 5-1 7, 20-21 , 23-27 and 30 have been amended. 

3. Claims 1-30 are pending for consideration. 

4. The terminal disclaimer filed on 08/12/2008 has been reviewed and is accepted. 
The terminal disclaimer has been recorded. 



Response to Arguments 

5. Applicant's arguments with respect to claims 1-30 have been considered but are 
moot in view of the new ground(s) of rejection. 

6. Regarding claims 11-19, Applicant's argument with respect to the 35 U.S.C. 101 
rejection has been fully considered in view of the amendment filed 07/1 1/2008, which 
has been made in record, and the 35 U.S.C. 101 rejection has been withdrawn. 
However, Applicant does not amend claim 20 to have the same features as the 
amended claim 1 1 . Therefore, Examiner maintains the 101 rejection for claim 20. 

7. Regarding claims 21 -30, adding the term "tangible" to the computer storage 
medium does not make these claims fall within one of the four statutory classes. 
According to the Dictionary.com, the term "tangible" defines either touchable or 
perceptible. Signal can be perceived. Therefore, Examiner maintains the 101 rejection 
for claims 21-30. 

8. Examiner has withdrawn the double patenting rejection in view of the terminal 
disclaimer filed on 08/12/2008, which has been made in record. 
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Claim Rejections - 35 USC § 101 

9. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

10. Claims 20 and 21-30 are rejected under 35 U.S.C. 101 because the claimed 
invention is directed to non-statutory subject matter. 

Claim 20 is directed to a system comprising the steps of means for detecting, 
means for applying and means for determining the anomalous traffic. According to the 
specification, paragraphs 0022 and 0030, the system can be in hardware and/or 
software. Therefore, claim 20 is a system software per se, failing to fall within a 
statutory category of invention (see MPEP 2106.01). 

Claims 21-30 are directed to a tangible computer storage medium having 
computer readable code embodied therein. According to the specification, paragraph 
0023, "computer-readable medium .... not limited to, an electronic, magnetic, optical, 
electromagnetic, infrared (e.g., carrier waves, infrared signals, digital signals, etc.) ... 
computer-readable medium could even be paper". In light of the specification, these 
claims do not fall within one of the four statutory classes of an invention 
(method/process, article of manufacture, a composition of matter, or machine). Carrier 
wave is a signal, not a series of steps. Carrier wave is a form of energy and not a 
composition of matter. Carrier wave does not have any physical structure, does not 
itself perform any useful, concrete and tangible result and thus does not fit within the 
definition of a machine or an article of manufacture. 
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The dependent claims are depended on the rejected base claim, and are 
rejected for the same rationales. 

Claim Rejections - 35 USC § 102 

1 1 . The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351 (a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21 (2) 
of such treaty in the English language. 

12. Claims 1-30 are rejected under 35 U.S.C. 102(e) as being anticipated by Cox et 
al. (US 6738814) (hereinafter Cox). 

Regarding claim 1, Cox discloses a method of operating a communication 
network, comprising: autonomously monitoring communication traffic at a 
communication port for an anomalous traffic (Cox: See Abstract section; and column 3 
lines 4-29); detecting an anomaly in communication traffic at a plurality of nodes in the 
communication network, wherein the anomaly is an attack other than a worm or virus 
(Cox: column 3 lines 30-54); independently applying, at respective ones of the plurality 
of nodes, a first blocking measure A to the anomalous traffic that stops the anomalous 
traffic (Cox: column 4 lines 28-36); and independently determining, at the respective 
ones of the plurality of nodes, a second blocking measure B such that application of a 
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logical combination of the first blocking measure A and the second blocking measure B 
to stop the anomalous traffic (Cox: column 4 lines 54-61). 

Regarding claims 2, 12 and 22, Cox discloses wherein independently 
determining the second blocking measure B comprises: applying a logical combination 
of A and a second blocking measure B given by (A & !B) to the anomalous traffic, 
wherein the logical combination (A & !B) is a less restrictive blocking measure than a 
logical combination (A & B); and enforcing the logical combination (A & !B) if the logical 
combination (A & !B) stops the anomalous traffic (Cox: column 4 lines 28-61). 

Regarding claims 3, 13 and 23, Cox discloses independently determining a third 
blocking measure C at the respective ones of the plurality of nodes such that application 
of a logical combination of (A & !B) and the third blocking measure C to the anomalous 
traffic stops the anomalous traffic if the logical combination (A & !B) stops the 
anomalous traffic (Cox: column 4 lines 21-24). 

Regarding claims 4, 14 and 24, Cox discloses wherein Independently 
determining the second blocking measure B further comprises: applying a logical 
combination (A & B) to the anomalous traffic if the logical combination (A & !B) does not 
stop the anomalous traffic; and enforcing the logical combination (A & B) If the logical 
combination (A & B) stops the anomalous traffic (Cox: column 4 lines 28-61). 

Regarding claims 5, 15 and 25, Cox discloses independently determining a third 
blocking measure C at the respective ones of the plurality of nodes such that application 
of a logical combination of (A & B) and the third blocking measure C to the anomalous 
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traffic stops the anomalous traffic if the logical combination (A & B) stops the anomalous 
traffic (Cox: column 4 lines 21-24). 

Regarding claims 6, 16 and 26, Cox discloses determining a third blocking 
measure C at the respective ones of the plurality of nodes such that application of a 
logical combination of A and the third blocking measure C to the anomalous traffic stops 
the anomalous traffic if the logical combination (A & B) does not stop the anomalous 
traffic (Cox: column 4 lines 21-24). 

Regarding claims 7, 17 and 27, Cox discloses wherein detecting an anomaly in 
the communication traffic comprises: comparing the communication traffic to at least 
one anomaly factor; and detecting the anomaly in the communication traffic at the 
plurality of nodes in the communication network if the at least one anomaly factor is 
present in the communication traffic (Cox: column 3 line 55 through column 4 Iine15; 
and column 4 lines 28-40). 

Regarding claims 8, 18 and 28, Cox discloses assigning a severity to the 
detected anomaly; and wherein independently applying the first blocking measure A to 
the anomalous traffic comprises independently applying the first blocking measure A to 
the anomalous traffic at each of the plurality of nodes in the communication network that 
stops or reduces the flow of the anomalous traffic based on the severity of the detected 
anomaly (Cox: column 3 line 55 through column 4 line 15). 

Regarding claims 9, 19 and 29, Cox discloses intentionally inserting the anomaly 
in the communication traffic; and associating the first blocking measure A and the 
second blocking measure B with the anomaly (Cox: column 4 lines 28-61). 
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Regarding claim 10, this claim has limitations that is similar to those of claim 1, 
thus it is rejected with the same rationale applied against claim 1 above. 

Regarding claim 1 1 , this claim has limitations that is similar to those of claim 1 , 
thus it is rejected with the same rationale applied against claim 1 above. 

Regarding claim 20, this claim has limitations that is similar to those of claim 1 , 
thus it is rejected with the same rationale applied against claim 1 above. 

Regarding claim 21 , this claim has limitations that is similar to those of claim 1 , 
thus it is rejected with the same rationale applied against claim 1 above. 

Regarding claim 30, this claim has limitations that is similar to those of claim 1, 
thus it is rejected with the same rationale applied against claim 1 above. 



Conclusion 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Examiner's Note: Examiner has cited particular columns and line numbers in the 
references applied to the claims above for the convenience of the applicant. Although 
the specified citations are representative of the teachings of the art and are applied to 
specific limitations within the individual claim, other passages and figures may apply as 
well. It is respectfully requested from the applicant in preparing responses, to fully 
consider the references in entirety as potentially teaching all or part of the claimed 
invention, as well as the context of the passage as taught by the prior art or disclosed 
by the Examiner. 
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In the case of amending tine claimed invention, Applicant is respectfully 
requested to indicate the portion(s) of the specification which dictate(s) the structure 
relied on for proper interpretation and also to verify and ascertain the metes and bounds 
of the claimed invention. 

1 3. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 
§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 
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Any inquiry concerning tliis communication or earlier communications from the 
examiner should be directed to TRANG DOAN whose telephone number is (571)272- 
0740. The examiner can normally be reached on Monday-Friday. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status Information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Trang Doan/ 
Examiner, Art Unit 2431 

/Syed Zla/ 

Primary Examiner, Art Unit 2431 



